fix(relay): delete devices atomically

[bobleer]

Summary

• scope device deletion to the authenticated account so a guessed device ID cannot affect another user
• revoke device auth tokens before deleting the device row and keep both writes in one transaction
• return 404 Not Found for devices outside the account and add route-level regression tests

Why

auth_tokens.device_id references devices.device_id, so deleting the device first can fail while active tokens exist. The previous deletion was also not scoped by user_id. The transactional helper preserves referential integrity and prevents partial or cross-account deletion.

Test plan

• cargo test -p bitfun-relay-service
• node scripts/check-core-boundaries.mjs
• cargo check --workspace
• git diff --check

AI-assisted: yes. Testing level: fully tested with automated Rust checks.